Transfers of personal data María Verónica Pérez Asinari

Introductory remarks Idea behind: Articles 7: limit controllers’ responsibility/ensure necessity and legitimacy. Article 8: idem + limit of applicable law. Article 9: idem + prevent delocalization to data havens (countries with no or lower protection) 7 and 8: no analogue in Directive 95/46/EC 9: analogue to Articles 25 and 26 of Directive 95/46/EC

Concept of “recipient” Article 2(g): “recipient” shall mean a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular inquiry shall not be regarded as recipients; Article 11 and 12: information to be supplied to the data subject: the recipients or categories of recipients

Art. 7: transfers within or between institutions Without prejudice to Articles 4, 5, 6 and 10: Personal data shall only be transferred if data are (a) necessary (b) for the legitimate performance of (c) tasks covered by the competence of the recipient Joint liability: sender and recipient Dialogue between sender and recipient

Example of a transfer’s clause "The transfer of personal data to you falls within the scope of Article 7 of Regulation (EC) 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. Accordingly, as the controller of the personal data hereby transmitted, you are responsible for ensuring that they are used only for the purpose for which they are transmitted. Processing in a way incompatible with that purpose, such as transferring it to another recipient where this is not necessary or legally required is contrary to the conditions upon which this data has been transferred to you."

Art. 8: transfer to recipients subject to Directive 95/46/EC (a) if recipient establishes necessity for the performance of a task carried out in the public interest or subject to the exercise of public authority (b) if recipient establishes necessity of having the data transferred and if there is no reason to assume that the data subject’s legitimate interests might be prejudiced

Art. 9: transfer to recipients NOT subject to Directive 95/46/EC (mainly TBDF) Adequacy principle Interpretation of WP29 Adequate safeguards Exceptions: restrictive application and strict interpretation